01598nas a2200157 4500008004100000245013000041210006900171260000900240520106500249653001501314653000801329100001901337700002001356700002401376856004001400 2019 eng d00aIdentifying potentially risky insider on-compliance using machine learning to assess multiple protection motivation behaviors0 aIdentifying potentially risky insider oncompliance using machine c20193 aCybersecurity researchers have made significant steps to understand the mechanisms of security policy compliance and unify theories of security behavior. However, due partly to the limitations of traditional variance model statistical methods, these studies by necessity typically focus on a single security policy issue. By contrast, new machine learning algorithms frequently employed by data scientists offer great promise as a new statistical approach for examining robust individualized interpretations of policy and can also identify potentially risky behaviors. This study proposes to explore cybersecurity training impediments of multiple protection motivation behaviors in ransomware prevention training. It demonstrates the feasibility of using machine learning with survey items from the cybersecurity research to predict non-compliance. It also illustrates a potentially novel method to statistically validate research theory through higher levels of ML prediction. This study is a work in progress and we seek feedback on its design and relevance.10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aCrossler, Robert, E uhttps://aisel.aisnet.org/wisp2019/101681nas a2200193 4500008004100000245008400041210006900125260000900194300001200203490000700215520112200222653001501344653000801359100001901367700002001386700001801406700002401424856003901448 2019 eng d00aInfoSec Process Action Model (IPAM): Targeting Insider's Weak Password Behavior0 aInfoSec Process Action Model IPAM Targeting Insiders Weak Passwo c2019 a201-2250 v333 aThe possibility of noncompliant behavior is a challenge for cybersecurity professionals and their auditors as they try to estimate residual control risk. Building on the recently proposed InfoSec Process Action Model (IPAM), this work explores how nontechnical assessments and interventions can indicate and reduce the likelihood of risky individual behavior. The multi-stage approach seeks to bridge the well-known gap between intent and action. In a strong password creation experiment involving 229 participants, IPAM constructs resulted in a marked increase in R2 for initiating compliance behavior with control expectations from 47 percent to 60 percent. Importantly, the model constructs offer measurable indications despite practical limitations on organizations' ability to assess problematic individual password behavior. A threefold increase in one measure of strong password behavior suggested the process positively impacted individual cybersecurity behavior. The results suggest that the process-nuanced IPAM approach is promising both for assessing and impacting security compliance behavior.10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aCorreia, John1 aCrossler, Robert, E uhttps://doi.org/10.2308/isys-5238102095nas a2200181 4500008004100000245009600041210006900137260000900206490000700215520144300222653001501665653000801680100001901688700002001707700002401727700001801751856014401769 2018 eng d00aInfoSec Process Action Model (IPAM): Systematically Addressing Individual Security Behavior0 aInfoSec Process Action Model IPAM Systematically Addressing Indi c20180 v493 aWhile much of the extant InfoSec research relies on single assessment models that predict intent to act, this article proposes a multi-stage InfoSec Process Action Model (IPAM) that can positively change individual InfoSec behavior. We believe that this model will allow InfoSec researchers to focus more directly on the process which leads to action and develop better interventions that address problematic security behaviors. Building on successful healthcare efforts which resulted in smoking cessation, regular exercise and a healthier diet, among others, IPAM is a hybrid, predictive, process approach to behavioral InfoSec improvement. IPAM formulates the motivational antecedents of intent as separate from the volitional drivers of behavior. Singular fear appeals often seen in InfoSec research are replaced by more nuanced treatments appropriately differentiated to support behavioral change as part of a process; phase-appropriate measures of self-efficacy are employed to more usefully assess the likelihood that a participant will act on good intentions; and decisional balance –assessment of pro and con perceptions – is monitored over time. These notions better align InfoSec research to both leading security practice and to successful comparators in healthcare. We believe IPAM can both help InfoSec research models better explain actual behavior and better inform practical security-behavior improvement initiatives.10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aCrossler, Robert, E1 aCorreia, John uhttps://www.researchgate.net/publication/321138048_InfoSec_Process_Action_Model_IPAM_Systematically_Addressing_Individual_Security_Behavior01537nas a2200181 4500008004100000245007500041210006900116260000900185300001000194490000700204520094600211653001501157653000801172100001901180700002001199700001901219856011701238 2015 eng d00aImproving IT Assessment with IT Artifact Affordance Perception Priming0 aImproving IT Assessment with IT Artifact Affordance Perception P c2015 a17-280 v193 aAccurately assessing organizational information technology (IT) is important for accounting professionals, but also difficult. Both auditors and the professionals from whom they gather data are expected to make nuanced judgments regarding the adequacy and effectiveness of controls that protect key systems. IT artifacts (policies, procedures, and systems) are assessed in an audit because they “afford” relevant action possibilities but perception preferences shade the results of even systematic and well-tested assessment tools. This study of 246 business students makes two important contributions. First we demonstrate that a tendency to focus on either artifact or organizational imperative systematically reduces the power of well-regarded IT measurements. Second, we demonstrate that priming is an effective intervention strategy to increase the predictive power of constructs from the familiar technology acceptance model (TAM).10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aKawalek, Peter uhttp://people.oregonstate.edu/~marshaby/Papers/IJAIS%20-%20IT%20Artifact%20Affordance%20Perception%20Priming.pdf01587nas a2200181 4500008004100000245010400041210006900145260000900214300001200223490000700235520102800242653001501270653000801285100001901293700002001312700001901332856005401351 2014 eng d00aIT Artifact Bias: How exogenous predilections influence organizational information system paradigms0 aIT Artifact Bias How exogenous predilections influence organizat c2014 a427-4360 v343 aEfforts in IS research have long sought to bridge the gap between the information technology (IT) function and strategic business interests. Efforts in IS research have long sought to bridge the gap between the information technology (IT) function and the strategic business interests. People perceive affordances (possibilities for action) in information technology artifacts differently as cognitive structures (schema) which bias individual focus. This study explores how an individual’s tendency to perceive the ‘trees’ in an IT ‘forest’ (artifact preference), affects their assessment of efforts to achieve more effective IT outcomes. The effect is demonstrated using a relatively simple IT success model. Further, in a sample of 120 survey responses supported by ten semi-structured interviews we demonstrate that job role and organizational IT complexity systematically impact artifact perception. A better understanding of IT artifact bias promises to help organizations better assess information systems.10aAccounting10aBIS1 aCurry, Michael1 aMarshall, Byron1 aKawalek, Peter uhttp://dx.doi.org/10.1016/j.ijinfomgt.2014.02.00500463nas a2200109 4500008004100000245007500041210006900116260002500185653000800210100001900218856011600237 2012 eng d00aIT Effectiveness Norms and Organizational Success: a Literature Review0 aIT Effectiveness Norms and Organizational Success a Literature R aManchester, UKc201210aBIS1 aCurry, Michael uhttps://dev.business.oregonstate.edu/biblio/it-effectiveness-norms-and-organizational-success-literature-review01599nas a2200157 4500008004100000245003900041210003900080260004900119520110400168653001501272653000801287100002001295700001901315700002201334856008501356 2010 eng d00aIT Governance Norms and IT Success0 aIT Governance Norms and IT Success aDecember 2010, Saint Louis, MO, U.S.A.c20103 aThe checklists included in well-known IT governance frameworks may be a good fit for
large organizations that face regulatory pressure and a need for large-scale coordination
but may be less appropriate for smaller organizations. Core IT governance principles
embedded in the structure of CobiT, ITIL, and ISO2000 can be expressed as a set of IT
governance norms including business alignment, a risk/control perspective, systematic
measurement, accountability, and continuous improvement. In this study, we model IT
effectiveness and willingness to comply with best practices as effects of adopting these
norms. We propose a set of survey items tailored to help assess the constructs in this
model then partially validate them using principal components analysis. Survey
responses (n=86) reveal a significant connection between evidence of norm adoption in
organizations and IT success. This norms-based paradigm may be useful in bringing
some of the benefits of IT governance to the smaller organizations that are thought to
drive economic growth and employment.10aAccounting10aBIS1 aMarshall, Byron1 aCurry, Michael1 aReitsma, Reindert uhttps://dev.business.oregonstate.edu/biblio/it-governance-norms-and-it-success-000463nas a2200109 4500008004100000245007800041210006900119260002300188653000800211100001900219856011500238 2009 eng d00aInternet Marketing: How to Use SEO and Social Networking to Reach Clients0 aInternet Marketing How to Use SEO and Social Networking to Reach aPortland, ORc200910aBIS1 aCurry, Michael uhttps://dev.business.oregonstate.edu/biblio/internet-marketing-how-use-seo-and-social-networking-reach-clients